A product team building a cloud-native customer portal has defined its features and plans to 'add security' after launch, once it sees how customers use the service. According to secure SDLC practice, when should security requirements first be defined?
Select an answer to reveal the explanation.
Short Explanation
Bolting security on after launch is like adding the foundation after you've built the house. You define security requirements right alongside the features, in the requirements phase, so design has something to design to. Testing can only check for what you asked for in the first place.
Full Explanation
A secure SDLC treats security as a requirement from the start. In the business requirements phase, the team identifies the data the application will handle, its classification, applicable legal and regulatory obligations, and the security functions needed, such as authentication, authorization, logging and encryption. These are documented with the functional requirements so the design phase can address them and the testing phase can verify them. Defining requirements first is also the cheapest point to address security, because defects found later require redesign and rework. Waiting until testing means scanners can only find implementation flaws in a design that never considered security; missing controls, such as absent authorization models or audit logging, are not discovered by scans of what exists. Configuring network and access settings at deployment is necessary operational work, but it cannot compensate for an application whose design lacks security functions. Waiting for maintenance and real attack data means exposing customers and data to known risks in production and accepting the highest cost of remediation. Exam caveat: secure by design, named in the 2026 outline, is the principle behind this answer; security requirements are inputs to design, not outputs of testing. Operational check: confirm the requirements document contains explicit security requirements with acceptance criteria and that each one traces to a design element and a test.